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Abstract 
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tyj I Electoral control models ways of changing the outcome of an election via such actions as 

O . adding/deleting/partitioning either candidates or voters. These actions modify an election's par- 

ticipation structure and aim at either making a favorite candidate win ("constructive control") 
or prevent a despised candidate from winning ("destructive control"), which yields a total of 
^ I 22 standard control scenarios. To protect elections from such control attempts, computational 

complexity has been used to show that electoral control, though not impossible, is computa- 
tionally prohibitive. Among natural voting systems with a polynomial-time winner problem, 
the two systems with the highest number of proven resistances to control types (namely 19 out 
of 22 |ENR09 E RlOllEPRlOl ) are "sincere-strategy preference-based approval voting" (SP- 
AV, a modification [ENR091 of a system proposed by Brams and Sanver IIBS06I ) and fallback 
^^ I voting |BS09| . Both are hybrid systems; e.g., fallback voting combines approval with Bucklin 

voting. In this paper, we study the control complexity of Bucklin voting itself and show that 
it behaves equally well in terms of control resistance for the 20 cases investigated so far. As 
. Bucklin voting is a special case of fallback voting, all resistances shown for Bucklin voting in 

K> ' this paper strengthen the corresponding resistance for fallback voting shown in MEPRIOI . 



1 Introduction 

Since the seminal paper of Bartholdi et al. IIBTT92 II. the complexity of electoral control — changing 
the outcome of an election via such actions as adding/deleting/partitioning either candidates or 
voters — has been studied for a variety of voting systems. Unlike manipulation ||BTT89[ IB0911 
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ICSL07[|FHHR09al . which models attempts of strategic voters to influence the outcome of an elec- 
tion via casting insincere votes, control models ways of an external actor, the "chair," to tamper with 
an election's participation structure so as to alter its outcome. Another way of tampering with the 
outcome of elections is bribery [FHH09 , FHHR09a| , which shares with manipulation the feature 
that votes are being changed, and with control the aspect that an external actor tries to change the 
outcome of the election. Faliszewski et al. ||FHHR09bll survey known complexity results for control, 
manipulation, and bribery. 

Elections have been used for preference aggregation not only in the context of politics and 
human societies, but also in artificial intelligence, especially in multiagent systems, and other topics 
in computer science (see, e.g., IIER971 IGMHS991 IDKNSOll ). That is why it is important to study 
the computational properties of voting systems. In particular, complexity can be used to protect 
elections against tampering attempts in control, manipulation, and bribery attacks by showing that 
such attacks, though not impossible in principle, are computationally prohibitive. 

Regarding control, a central question is to find voting systems that are computationally resistant 
to as many of the common 22 control types as possible, where resistance means the corresponding 
control problem is NP-hard. Each control type is either constructive (the chair seeking to make 
some candidate win) or destructive (the chair seeking to make some candidate not end up winning). 
Erdelyi and Rothe HER 1 Oil proved that fallback voting MBS 091 . a hybrid voting system combining 
Bucklin with approval voting, is resistant to each of these 22 standard control types except five types 
of voter control. They proved that fallback voting is vulnerable to two of those control types (i.e., 
these control problems are polynomial-time solvable), leaving the other three cases open. Erdelyi, 
Piras and Rothe HEPRlOl recently proved that fallback voting is resistant to constructive and de- 
structive control by partition of voters in the tie-handling model "ties promote." 

Thus fallback voting is not only fully resistant to candidate control MERIOI but also fully re- 
sistant to constructive control. In terms of the total number of proven resistances it draws level 
with "sincere-strategy preference-based approval voting" (SP-AV, another hybrid system proposed 
by Brams and Sanver [BS06|): Both have the most (19 out of 22) proven resistances to con- 
trol among natural voting systems with a polynomial-time winner problem. Among such sys- 
tems, only plurality and SP-AV were previously known to be fully resistant to candidate control 
IIBTT92I IHHR07I |ENR09i and only Copeland voting and SP-AV were previously known to be 
fully resistant to constructive control IIFHHR09al IENR091I . However, plurality has fewer resistances 
to voter control, Copeland voting has fewer resistances to destructive control, and SP-AV is arguably 
less natural a system than fallback voting IIENR09llBEH+09t . 

Even more natural than fallback voting, however, is BuckUn voting itself, one of its two con- 
stituent systems. After all, fallback voting is a hybrid system in which voters are required to provide 
two types of preference (a ranking of candidates and an approval vector), whereas in Bucklin vot- 
ing it is enough for the voters to rank the candidates. Moreover, Bucklin voting has the important 
property that it is majority-consistent, which means that whenever a majority candidate existslJ he 
or she is the (unique) Bucklin winner. In contrast, fallback voting is not majority-consistent. 

In this paper, we study the control complexity of Bucklin voting and show that it has as many 
control resistances as fallback voting in the 20 cases investigated so far. In particular, Bucklin voting 



' A majority candidate is a candidate that is ranked at top position in more than half of the votes. 



is also fully resistant to both candidate control and constructive control. 

This paper is organized as follows. In Section |2l some basic notions from social choice theory, 
and in particular Bucklin voting, as well as the 22 standard types of control are defined. Our results 
on the control complexity of Bucklin voting are presented in Section [3l Finally, Section |4]provides 
some conclusions and open questions. 

2 Preliminaries 

2.1 Elections and Voting Systems 

An election (C, V) is given by a finite set C of candidates and a finite list V of votes over C. A voting 
system is a rule that specifies how to determine the winner(s) of any given election. The two voting 
systems considered in this paper are Bucklin voting and fallback voting. 

In Bucklin voting, votes are represented as linear orders over C, i.e., each voter ranks all candi- 
dates according to his or her preferences. For example, if C = {a, ft, c, d] then a vote might look like 
c d a b, i.e., this voter (strictly) prefers c to d, d to a, and a to b. Given an election {C,V) and 
a candidate c G C, define the level i score of c in (C, V) (denoted by score\^yAc)) as the number 
of votes in V that rank c among their top / positions. Denoting the strict majority threshold for a 
list V of voters by maj(V) = [ll^ll/ij + 1, the Bucklin score ofc in {C,V) is the smallest / such that 
score',^yJc) > maj(y). All candidates with a smallest Bucklin score, say k, and a largest level k 
score are the Bucklin winners (BV winners, for short) in (C, V). If some candidate becomes a Buck- 
lin winner on level k, we call him or her a level k BV winner in {C,V). Note that a level 1 BV winner 
must be unique, but there may be more level k BV winners than one for ^ > 1, i.e., an election may 
have more than one Bucklin winner in general. 

As a notation, when a vote contains a subset of the candidate set, such as c D a for a subset 
D C C, this is a shorthand for c Ji • • • de a, where the elements of D = {di,. ■■ ,d£} are ranked 
with respect to some (tacitly assumed) fixed ordering of all candidates in C. For example, if C = 
{a,b,c,d} and D = {b,d} then "c D a" is a shorthand for the vote c b d a. 

2.2 Types of Electoral Control 

There are 11 types of electoral control, each coming in two variants. In constructive con- 
trol IIBTT92II . the chair tries to make his or her favorite candidate win; in destructive con- 
trol fHHROV], the chair tries to prevent a despised candidate's victory. We refrain from giving a 
detailed discussion of real-life scenarios for each of these 22 standard control types that motivate 
them; these can be found in, e.g., IIBTT921 IHHROTI [FHHR09a, HHR09. ENR09II . However, we 
stress that every control type is motivated by an appropriate real-life scenario. 

We start with partition of voters with the tie-handling rule "ties promote" (TP), see Hemaspaan- 
dra et al. IIHHR07i . This control type produces a two-stage election with two first-stage and one 
final-stage subelections. The constructive variant of this problem is: 

Name: Constructive Control by Partition of Voters in TP. 

Instance: A set C of candidates, a list V of votes over C, and a designated candidate c ^C. 



Question: Can V be partitioned into Vi and V2 such that c is the unique winner of the two-stage 
election in which the winners of the two first-stage subelections, (C,Vi) and (€,¥2), run 
against each other in the final stage? 

The destructive valiant of this problem is defined analogously, except it asks whether c is not 
a unique winner of this two-stage election. In both variants, if one uses the tie-handling model 
TE ("ties eliminate," see IIHHR07I ) instead of TP in the two first-stage subelections, a winner w 
of (C,Vi) or {€,¥2) proceeds to the final stage if and only if w is the only winner of his or her 
subelection. Each of the four problems just defined models "two-district gerrymandering." 

There are many ways of introducing new voters into an election — think, e.g., of "get-out-the- 
vote" drives, or of lowering the age-limit for the right to vote, or of attracting new voters with certain 
promises or even small gifts), and such scenarios are modeled as CONSTRUCTIVE/DESTRUCTIVE 
Control by Adding Voters: Given a set C of candidates, two disjoint hsts of votes over C 
(one list, V, corresponding to the already registered voters and the other list, W, corresponding 
to the as yet unregistered voters whose votes may be added), a designated candidate c £ C, and a 
nonnegative integer k, is there a subset IV' C IV such that ||Wj| < k and c is (is not) the unique 

winner in (C,yuW)? 

Disenfranchisement and other means of voter suppression is modeled as CONSTRUC- 
TIVE/DESTRUCTIVE Control by Deleting Voters: Given a set C of candidates, a hst V 
of votes over C, a designated candidate c £ C, and a nonnegative integer k, can one make c the 
unique winner (not a unique winner) of the election resulting from deleting at most k votes from VI 

Having defined these eight standard types of voter control, we now turn to the 14 types of 
candidate control. Now, the control action seeks to influence the outcome of an election by either 
adding, deleting, or partitioning the candidates, again for both the constructive and the destructive 
variant. 

In the adding candidates cases, we distinguish between adding, from a given pool of spoiler can- 
didates, an unlimited number of such candidates (as originally defined by Bartholdi et al. IBTT92I ) 
and adding a limited number of spoiler candidates (as defined by Faliszewski et al. ||FHHR09all . 
to stay in sync with the problem format of control by deleting candidates and by adding/deleting 
voters). Constructive/Destructive Control by Adding (a Limited Number of) Can- 
didates, is defined as follows: Given two disjoint candidate sets, C and D, a list V of votes over 
CUD, a designated candidate c £C, and a nonnegative integer k, can one find a subset D' QD 
such that ||D'|| < k and c is (is not) the unique winner in (CUZ)',V)? The "unlimited" version of 
the problem is the same, except that the addition limit k and the requirement "||D'|| < k" are being 
dropped, so any subset of the spoiler candidates may be added. 

Constructive/Destructive Control by Deleting Candidates is defined by: Given 
a set C of candidates, a list V of votes over C, a designated candidate c £ C, and a nonnegative 
integer k, can one make c the unique winner (not a unique winner) of the election resulting from 
deleting at most k candidates (other than c in the destructive case) from C? 

Finally, we define the partition-of-candidate cases, again using either of the two tie-handling 
models, TP and TE, but now we define these scenarios with and without a run-off. The variant with 
run-off, Constructive/Destructive Control by Run-Off Partition of Candidates, 
is analogous to the partition-of-voters control type: Given a set C of candidates, a list V of votes 
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over C, and a designated candidate c ^C, can C be partitioned into Ci and C2 such that c is (is not) 
the unique winner of the two-stage election in which the winners of the two first-stage subelections, 
(Ci,y) and (C2, V), who survive the tie-handling rule run against each other in the final stage? The 
variant without run-off is the same, except that the winners of first-stage subelection {Ci,V) who 
survive the tie-handling rule run against {C2,V) in the final round (and not against the winners of 
(C2, V) surviving the tie-handling rule)o 

2.3 Immunity, Susceptibility, Resistance, and Vulnerability 

Let (TT be a control type. We say a voting system is immune to €fZ if it is impossible for the chair 
to make the given candidate the unique winner in the constructive case (not a unique winner in the 
destructive case) via exerting control of type G^T. We say a voting system is susceptible to €.% if 
it is not immune to €.%. A voting system that is susceptible to G^T is said to be vulnerable to €.% 
if the control problem corresponding to €fZ can be solved in polynomial time, and is said to be 
resistant to €fZ if the control problem corresponding to G^T is NP-hard. These notions are due to 
Bartholdi et al. IIBTT92I (except that we follow the now more common approach of Hemaspaandra 
et al. IIHHR09II who define resistant to mean "susceptible and NP-hard" rather than "susceptible and 
NP-complete"). 

3 Results 

3.1 Overview 

Table[T]shows in boldface our results on the control complexity of Bucklin voting. For comparison, 
this table also shows the results for fallback voting that are due to Erdelyi et al. llERlOllEPRlO I. for 
approval voting that are due to Hemaspaandra et al. [iHHR07il . and for SP-AV that are due to Erdelyi 
et al. I ENR091 . 

Theorem 3.1. Bucklin voting is resistant, vulnerable, and susceptible to the 22 types of control 
defined in Section\2\as shown in Table\J\ 

Since Bucklin voting is the special case of fallback voting where each voter approves of ev- 
ery candidate, we have the following corollary. Note that, by the first item of Corollary 13.21 the 
resistances for BuckUn voting shown in the present paper imply all resistances for fallback voting 
shown in HER lOilEPR 1011 except one: the destructive case of partition of voters in the tie-handling 
model TP. 

Corollary 3.2. 1. Fallback voting inherits all the NP-hardness lower bounds from Bucklin vot- 
ing (i.e., if Bucklin voting is resistant to a control type ^% then fallback voting is also resistant 
to (tV- 

2. Bucklin voting inherits all the P membership upper bounds from fallback voting (i.e., if fall- 
back voting is vulnerable to a control type <t1- then Bucklin voting is also vulnerable to (£Tj. 



^For example, think of a sports tournament in wliich certain teams (sucli as last year's champion and the team hosting 
this year's championship) are given an exemption from qualification. 
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Table 1: Overview of results and comparison with known results. Key: I = immune, S = suscepti- 
ble, R = resistant, V = vulnerable, TE = ties eliminate, and TP = ties promote. Results new to this 
paper are in boldface. 

3.2 Susceptibility 

If an election system S satisfies the "unique" variant of the Weak Axiom of Revealed Preference^ 
(Unique- WARP, for short), then ^ is immune to constructive control by adding candidates (by 
adding a Umited number of candidates), and this observation has been applied to approval vot- 
ing [ BTT921 [HHR07II . Unlike approval voting but just as fallback voting, Bucklin voting does not 
satisfy Unique-WARP. 



Proposition 3.3. Bucklin voting does not satisfy Unique-WARP. 



Proof. Consider the election (C,V) with candidate set C = 

{vi,V2,...,V6}: 

_{C,V) 



{a,b,c,d} and voter collection V 



V2=V3 


a c b d 


V4=V5 


b d c a 


V6 


d a c b 



Candidate a is the unique Bucklin winner of the election {C,V), reaching the strict majority 
threshold on level 2 with score}^ ^,^ {a) = 4. By removing candidate b from the election, we get 
the subelection (C',V) with C' = {a,c,d}. There is no candidate on level 1 who passes the strict 
majority threshold. However, there are two candidates on the second level with a strict majority. 



namely candidates a and c. Since score}^, y\{c) 



5 > 4 = score, ^1 y. {a), the unique Bucklin winner 



of the subelection {C\V) is candidate c. Thus, Bucklin voting does not satisfy Unique-WARP. □ 

Indeed, as we will now show, Bucklin voting is susceptible to each of our 22 control types. Our 
proofs make use of the results of IIHHR07I that provide general proofs of and links between certain 



This axiom says that the unique winner w of any election is also the unique winner of every subelection including w. 



susceptibility cases. For the sake of self-containment, we state their results, as Theorems lA. 1 [ lA!2l 
and lA.3[ in the appendix. 

We start with susceptibility to candidate control. 

Lemma 3.4. Bucklin voting is susceptible to constructive and destructive control by adding candi- 
dates (in both the "limited" and the "unlimited" case), by deleting candidates, and by partition of 
candidates (with or without run-off and for each in both model TE and model TP). 

Proof. From Theorem I A. H and the fact that Bucklin voting is a voiced voting systemO it follows 
that Bucklin voting is susceptible to constructive control by deleting candidates, and to destructive 
control by adding candidates (in both the "limited" and the "unlimited" case). 

Now, consider the election {C,V) given in the proof of Proposition 13.31 The unique Bucklin 
winner of the election is candidate a. Partition C into Ci = {a,c,d} and C2 = {b}. The unique 
Bucklin winner of subelection {Ci,V) is candidate c, as shown in the proof of Proposition 13.31 In 
both partition and run-off partition of candidates and for each in both tie-handling models, TE and 
TP, candidate b runs against candidate c in the final stage of the election. The unique Bucklin winner 
is in each case candidate c. Thus, Bucklin voting is susceptible to destructive control by partition of 
candidates (with or without run-off and for each in both model TE and model TP). 

By Theorem IA.3I Bucklin voting is also susceptible to destructive control by deleting candi- 
dates. By Theorem I A. 2[ Bucklin voting is also susceptible to constructive control by adding candi- 
dates (in both the "limited" and the "unlimited" case). 

Now, changing the roles of a and c makes c our distinguished candidate. In election {C,V), c 
loses against candidate a. By partitioning the candidates as described above, c becomes the unique 
Bucklin winner of the election. Thus, Bucklin voting is susceptible to constructive control by par- 
tition of candidates (with or without run-off and for each in both tie-handling models, TE and TP). 
□ 

We now turn to susceptibility to voter control. 

Lemma 3.5. Bucklin voting is susceptible to constructive and destructive control by adding voters, 
by deleting voters, and by partition of voters (in both model TE and model TP). 

Proof. Consider the election {C,V), where C = {a,b,c,d} is the set of candidates and V = 
{vi,V2,V3,V4} is the collection of voters with the following preferences: 

ic,v) 



1 


a c 


b d 


2 


d c 


a b 


3 


b a 


c d 


4 


b a 


c d 



An election system is said to be voiced if the single candidate in any one-candidate election always wins. 



We partition V into Vi = {v\,V2} and V2 = {v3,V4}. Thus we split {C,V) into two subelections: 

iCVi) and iC,V2) 



vi : 


a c b d 




V2 : 


d c a b 




V3: 




b a c d 


V4: 




b a c d 



Clearly, candidate a is the unique Bucklin winner of (C, V). However, c is the unique Bucklin 
winner of {C^Vy) and b is the unique Bucklin winner of (C,V2). and so a is not promoted to the 
final stage. Thus, Bucklin voting is susceptible to destructive control by partition of voters in both 
tie-handling models, TE and TP. 

By Theorem lA.il and the fact that Bucklin voting is a voiced voting system, Bucklin voting 
is susceptible to destructive control by deleting voters. By Theorem IA.21 Bucklin voting is also 
susceptible to constructive control by adding voters. 

By changing the roles of a and c again, we can see that Bucklin voting is susceptible to con- 
structive control by partition of voters in both model TE and model TP. By Theorem IA.3[ Bucklin 
voting is also susceptible to constructive control by deleting voters. Finally, again by Theorem lA.2[ 
Bucklin voting is susceptible to destructive control by adding voters. □ 



3.3 Candidate Control 

Fallback voting is a hybrid system combining Bucklin voting with approval voting. While fallback 
and approval voting behave quite differently with respect to immunity/vulnerability/resistance to 
control (contrast the results of Hemaspaandra et al. on approval voting IIHHRO?! with those of 
Erdelyi et al. MERlOl |EPR101 on fallback voting, see Table [Hi, Bucklin voting seems to behave 
equally well as fallback voting in terms of control resistance. In particular, like fallback voting, 
Bucklin voting is also fully resistant to candidate control. 

Theorem 3.6. Bucklin voting is resistant to each of the 14 standard types of candidate control. 

All reductions except one (namely that for constructive control by deleting candidates, see 
Lemma 13.131 ) apply Construction 13.81 below. This construction is based on that for fallback vot- 
ing MERIOII : however, there are significant differences. In fallback voting, the disapproved candi- 
dates need not be ranked and can safely be ignored, since they cannot score points. In Bucklin 
voting, however, there are no disapproved candidates, so every candidate has to be placed at a suit- 
able position in each vote to make the reduction work. Thus the reductions for Bucklin voting will 
be more specific and the arguments more involved. Also, since every candidate can potentially score 
points in Bucklin voting, no matter what his or her position in a vote is, we have to use a restricted 
version of HITTING Set , which by Lemma l377] is also NP-complete: 



Name: Restricted Hitting Set. 

Instance: A set B = {b\ ,b2,... ,bm},a. collection y = {Si , ^i , . . . , 5„ } of nonempty subsets Si C B 
such that n> m, and a positive integer k <m. 



Question: Does .5^ have a hitting set of size at most k, i.e., is there a set B' QB with ||B']| < k such 
that for each r, 5/ n B V0? 

We first need to show that RESTRICTED HITTING Set is NP-complete in order to apply Con- 
struction [32] in the proof of Theorem [3^ 

Lemma 3.7. Restricted Hitting Set is NP-complete. 

Proof. It is immediate that RESTRICTED HITTING Set is in NP. To show NP-hardness, we 
reduce the (general) HITTING Set problem to Restricted Hitting Set. Given an instance 
{B,S^,k) of Hitting Set , where B = {bi,b2,..., b^} is a set, S^ = {Si,S2,...,Sn}ha. collection 
of nonempty subsets of B, and k<m is a positive integer, define the following instance {B,S^ ,k) of 
Restricted Hitting Set: 



B 

k 
where 



B\j{a} if n<m 
B ifn>m 

^ U {Sn+U Sn+2, ■■■, Sm+l} H n < ih 

^ iin> m 

k+ I if h<m 
k iih>m, 



Sfi+l — Sn+2 — ■■■ — Sm+2 — {o'}- 

Let n be the number of members of J^ and m be the number of elements of B. Note that ifn>m 
then {B,J^,k) = {B,y,k), son = n> rh = m; and ifn<m then n = m + 2>rh + l=m. Thus, in 
both cases {B,y,k) fulfills the restriction of RESTRICTED HITTING Set. 

It is easy to see that y has a hitting set of size at most k if and only if y has a hitting set 
of size at most k. In particular, assuming n < m, if y has a hitting set B' of size at most k then 
B' U {a} is a hitting set of size at most ^ = ^ + 1 for y; and if y has no hitting set of size at most k 
then y can have no hitting set of size at most k = k+l (because a B, so {a} n S,- = for each /, 
1 < / < «). □ 

Construction 3.8. Let {B,y,k) be a given instance o/ RESTRICTED HITTING Set, where B = 
{bi,b2, ■ ■ ■ ,bfn} is a set, y = {Si,5'2, . . . ,Sn} is a collection of nonempty subsets Si C B such that 
n> m, and k <mis a positive integer. (Thus, n> m> k> I.) 

Define the election {C,V), where C = BU {c,d,w} is the candidate set and where V consists of 
the following 6n{k+\) +4m+ 11 voters: 



# 


For each . . . 


number of voters 


ranking of candidates 


1 




2m+l 


c d B w 


2 




2n + 2k{n-\) + -i 


c w d B 


3 




2n{k+\)+5 


w c d B 


4 


ie{\,...,n} 


2{k+\) 


d Si c w {B-Si) 


5 


j€{l,...,m} 


2 


d bjw c {B-{bj}) 


6 




2{k+\) 


d w c B 



We now give a detailed proof of Theorem 13.61 (except for the case of constructive control by 
deleting candidates, which will be handled separately in Lemma [3.13l ) via Construction 13. 8| in Lem- 
mas [3?T0l[3?TIl and l3.12l The proofs of these lemmas in turn will make use of Lemma [3^ below. 

Lemma 3.9. Consider the election {C,V) constructed according to Construction \3.8\ from a RE- 
STRICTED Hitting Set instance {B,y,k). 

1. c is the unique level 2 BV winner o/({c,(jf,w},y). 

2. Ify has a hitting set B' of size k, then w is the unique BV winner of election (B' U {c,d, w},V). 

3. Let D QBL) {d, w}. If c is not a unique BV winner of election (D U {c}, V), then there exists 
a set B' QB such that 

(a) D = B'u{d,w}, 

(b) w is the unique level 2 BV winner of election {B' U {c,d,w},V), and 

(c) B' is a hitting set for 5^ of size at most k. 

Proof. For the first part, note that there is no level 1 BV winner in election ({c, J,h'}, V) and we 
have the following level 2 scores in this election: 



score 



({c,rf,vv},y)l 

1 
({c,rf,w}y) 



score u,^,,.XM Ac] = 6n{k+l) + 2{m-k)+9, 

(d) = 2n{k+\) + 4m + 2k + 3, and 
^^^^^t{cM,w},v) M = 4n{k+l)+2m+ 10. 
Since n > m (which implies n > k), we have: 

^core1{c4.w}y)ic) - scoreli^^^^^x^y^id) = An{k+\) - {2m + Ak) + 6> 0, and 



scored, ^ J ..,x ,n (c) - scorej^^^^^^,yy^ 



(w) 



2n{k+l)-{2k+l) > 0. 



-{{c,d,w}.y)^ 

Thus, c is the unique level 2 BV winner of {{c,d,w},V). 

For the second part, suppose that B' is a hitting set for J?^ of size k. Then there is no level 1 BV 
winner in election {B' [j{c,d,w},V), and we have the following level 2 scores: 



score 



score 



{B'U{c,d,w}.y) 

I 

(S'U{c,d,w},y) 



score 



(B'U{c,rf,w},y) 



{d) 



w] 



4n{k+\)+2{m-k)+9, 
2n{k+\)+Am + 2k + l>, 
4n{k+ \) + 2{m-k) + 10, 



'(^orejs'u{cJM'},v)(^j) ^ 2n{k+l) + 2 for all bj^B'. 
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It follows that w is the unique level 2 BV winner of election {B' U{c,d,w},V). 

For the third part, let D C B u {d,w}. Suppose c is not a unique BV winner of election (D U 

{c},V). 

a]) Other than c, only w has a strict majority of votes on the second level and only w can tie or 
beat c in (D U {c}, V). Thus, since c is not a unique BV winner of election (D U {c}, V), w is 
clearly in D. In {D U {c}, V), candidate w has no level 1 strict majority, and candidate c has 
already on level 2 a strict majority. Thus, w must tie or beat c on level 2. For a contradiction, 
suppose d ^ D. Then 

i'core(£,u|^jy-)(c) >4n{k+ l)+2m+ 11. 

The level 2 score of w is 

.ycore(£,Lj|^|y) (w) =4«(^+l)+2m+ 10, 

which contradicts our assumption, that w ties or beats c on level 2. Thus, D = B' U {d,w}, 
where B' C B. 



3bl) This part follows immediately from part (I3al) . 
c]) Let £ be the number of sets in ^ not hit by B'. We have that 

'(^ore}s,uic.d.^\.v)M = 4?2(^+l) + 10 + 2(m-||B'||), 



scoreL^r^.yJc) = 2{m-k) +4n{k+l) +9 + 2{k+l)e. 



'{B'U{c,d,w},V) 
'{B'U{c,d,w}y) 

From part (l3al) we know that 

^corejB/u{,,rf,w},y)(>v) > ^core^B/u{c-,rf,w}y)(c), 
so 

4?2(yt+l) + 10 + 2(m-||B'||) > 2{m-k) +4n{k+ I) +9 + 2{k+\)e. 

The above inequality implies 

1>^> ||S'|l-/t + (/t+l)£>0, 

so ||B'|| -A: + (A;+1)£ = 0. Thus £ = 0, and it follows that B' is a hitting set for ^ of size A:. 
This completes the proof of Lemma [l!9l □ 

Lemma 3.10. Bucklin voting is resistant to constructive and destructive control by adding candi- 
dates (both in the limited and the unlimited version of the problem). 



Proof. Susceptibility holds by Lemma [X4l NP-hardness follows immediately from Lemmas 
and |3.9[ via mapping the RESTRICTED HITTING Set instance {B,y,k) to the instance 
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1. {{{c,d,w}UB,V),w,k) of Constructive Control by Adding a Limited Number of Candidates, 

2. {{{c,d,w}UB,V),c,k) of Destructive Control by Adding a Limited Number of Candidates, 

3. {{{c,d,w} L}B,V),w) of Constructive Control by Adding an Unlimited Number of Candi- 
dates, and 

4. {{{c,d,w}UB,V),c) of Destructive Control by Adding an Unlimited Number of Candidates, 
where in each case c, d, and w are the qualified candidates and B is the set of spoiler candidates. □ 

Lemma 3.11. Bucklin voting is resistant to destructive control by deleting candidates. 

Proof. Susceptibility holds by Lemma 1X4] To show the problem NP-hai^d, let (C, V) be the elec- 
tion resulting from a RESTRICTED HITTING Set instance {B,y,k) according to Construction 13.81 
and let c be the distinguished candidate. 

We claim that ^ has a hitting set of size at most k if and only if c can be prevented from being 
a unique BV winner by deleting at most m — k candidates. 

From left to right: Suppose y has a hitting set B' of size k. Delete the m — k candidates B — B'. 
Now, both candidates c and w have a strict majority on level 2, but 

■^corefr , ,uB'y)(c) = 4?2(/: + l)+2(m-^) + 9, 



'({c,rf,w}UB',V 
'({c,d,w}UB',V)'^ 



^(^of^Ucdw\uB'v)M = 4n{k + I) +2{m-k) + 10, 



so w is the unique level 2 BV winner of this election. 

From right to left: Suppose that c can be prevented from being a unique BV winner by deleting 
at most m — k candidates. Let D' C B u {d,w} be the set of deleted candidates (so c ^ D') and 
D = {C - D') - {c}. It follows immediately from Lemma [l!9l that D = B' U {d,w}, where B' is a 
hitting set for y of size at most k. □ 

Lemma 3.12. Bucklin voting is resistant to constructive and destructive control by partition of 
candidates and by run-off partition of candidates (for each in both tie-handling models, TE and TP). 

Proof. Susceptibility holds by Lemma [T4l so it remains to show NP-hardness. For the construc- 
tive cases, map the given RESTRICTED HITTING Set instance {B,y ,k) to the election (C, V) from 
Construction 13 . 8 1 with distinguished candidate w. 

We claim that y has a hitting set of size at most k if and only if w can be made the unique 
B V winner by exerting control via any of our four control scenarios (partition of candidates with or 
without run-off, and for each in either tie-handling model, TE and TP). 

From left to right: Suppose y has a hitting set B' (IB of size k. Partition the set of candidates 
into the two subsets Ci = B' U {c,d,w} and C2 = C — Ci. According to Lemma [l!9l w is the unique 
level 2 BV winner of subelection (Ci, V) = {B' U {c,d,w},'V). Since (no matter whether we have 
a run-off or not, and regardless of the tie-handling rule used) the opponents of w in the final stage 
(if there are any opponents at all) each are candidates from B. Since n> m,w has a majority in the 
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final stage on the first level with a score of 4n{k + 1) + 9. Thus, w is the unique BV winner of the 
resulting election. 

From right to left: Suppose w can be made the unique BV winner via any of our four control 
scenarios. Since c is not a B V winner of the election, there is a subset D QBU {d, w} of candidates 
such that c is not a unique BV winner of the election (DU {c},V). By Lemma [T91 there exists a 
hitting set for y of size at most k. 

For the four destructive cases, we simply change the roles of c and w in the above argument. □ 

Next we handle the one missing candidate-control case for Bucklin voting. Our reduction in this 
case is from the NP-complete problem HITTING Set , which is defined as follows (see IIGJ791 ): 

Name: Hitting Set . 

Instance: A set B = {bi,b2,- ■ ■ ,bm}, a collection y = {51,52,. . . ,5„} of nonempty subsets 5; C B, 

and a positive integer k < m. 
Question: Does 5^ have a hitting set of size at most k, i.e., is there a set B' QB with ||B'|| < k such 

that for each /, 5,- n B V0? 

Lemma 3.13. Bucklin voting is resistant to constructive control by deleting candidates. 



Proof. Susceptibility holds by Lemma 13.41 To prove NP-hardness we give a reduction from 
Hitting Set . Let {B,y,k) be a Hitting Set instance with B = {bi,b2,...,bm} a set, y = 
{Si , ^2 , . . . , 5„ } a collection of nonempty subsets 5,- C B, and k <m a. positive integer. Define the 

election {C,V) with candidate set C = BuC UDUE U F U {w}, where C' = {cucj,-.- ,Ck+i}, 
D = {di,d2,- ■ ■ ,ds}, E = {ei,e2,... ,e„}, F = {f\,... ,fn+k}, w is the distinguished candidate, and 



the number of candidates in D is 5 
For each /, I < i <n, let D, = {d 

2(n + k + l) + l voters: 



YJ^^i Si with Si 



n + k— \\Si\ 



so s 



+ kn-i:U\\Si 



i+E^i^y' 



l\^i 



}. Define V to be the following collection of 



# 


For each . . . 


number of voters 


ranking of candidates 


1 


/£{!,...,«} 


1 


5,- Di w C E {D-Di) (B-Si) F 


2 


7G{l,...,fc+l} 


1 


E {C'-{cj}) cj B D w F 


3 




k+\ 


w F C E B D 


4 




n 


C D F B w E 


5 




1 


C w D F E B 



There is no unique BV winner in election (C, V), since the candidates in C' and candidate w are 
level n + k+ IBY winners. 

We claim that y has a hitting set of size k if and only if w can be made the unique BV winner 
by deleting at most k candidates. 

From left to right: Suppose y has a hitting set B' of size k. Delete the corresponding candidates. 
Now, w is the unique level n + k B V winner of the resulting election. 

From right to left: Suppose w can be made the unique BV winner by deleting at most k can- 
didates. Since k+ I candidates other than w have a strict majority on level n + k + l in election 
{C,V), after deleting at most k candidates, there is still at least one candidate other than w with a 
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strict majority of approvals on level n + k + l. However, since w was made the unique BV winner 
by deleting at most k candidates, w must be the unique BV winner on a level lower than or equal to 
n + k. This is possible only if in all n votes of the first voter group w moves forward by at least one 
position. This, however, is possible only if =5^ has a hitting set B' of size k. □ 



3.4 Voter Control 

We now turn to voter control for Bucklin voting. Our reductions are from the NP-complete problem 
Exact Cover by Three-Sets (X3C, for short), which is defined as follows (see |,GJ79,I ): 

Name: Exact Cover by Three-Sets (X3C). 

Instance: A set S = {bi,b2,--- ,b3m}, m>\, and a collection y = {5'i,5'2,. . . ,5,,} of subsets 

Si C B with 115,11 = 3 for each /, \ <i <n. 
Question: Is there a subcoUection .y C y such that each element of B occurs in exactly one set 

in=^'? 

Theorem 3.14. Bucklin voting is resistant to constructive control by adding voters, by deleting 
voters, and by partition of voters in model TE and model TP, but is vulnerable to destructive control 
by adding and by deleting voters. 

Lemma 3.15. Bucklin voting is resistant to constructive control by adding voters. 

Proof. Susceptibility holds by Lemma 13.51 Let {B,y) be an X3C instance, where B = 
{bi,b2,---,bjm} is a set with m > 1 and y = {Si^Sj,--- ,S„} is a collection of subsets Sj C B 
with ||5,|| = 3 for each /, I <i <n. (Note that X3C is trivial to solve for m = 1.) 

Define the election {C,V UV'), where C = BU {w} UD with D = {di,. .. ,fi?,](3,„-4)} is the set 
of candidates, w is the distinguished candidate, and V U V is the following collection of « + m — 2 
voters: 

1. y is the collection of m — 2 registered voters of the form: B D w. 

2. V' is the collection of unregistered voters, where for each /, I < i <n, there is one voter of 
the form: Di Si w {D - D,-) {B - Si) , where D,- = {^(;_ i)(3,„-4)+i ,■■■, ^■(3m-4) }■ 

Since b\ &B has a majority already on the first level, w is not a unique BV winner in {C,V). 

We claim that y has an exact cover for B if and only if w can be made a unique BV winner by 
adding at most m voters from V' . 

From left to right: Suppose y contains an exact cover for B. Let V" contain the correspond- 
ing voters from V' (i.e., voters of the form D,- Si w (D — Di) (B — Sj), for each Sj in the ex- 
act cover) and add V" to the election. It follows that score^,^y^yjy„-.{dj) = m — \ for all dj G D, 
score^,^y^^jy„. (bj) = m — 1 for all bj G B, and i'core?™+Jj^„> (w) = m. Thus, only w has a strict major- 
ity up to the {3m + l)st level and so w is the unique level 3m + 1 BV winner of the election. 

From right to left: Let V" C V' be such that \\V"\\ <m and w is the unique winner of election 
{C,V U V"). Since w must in particular beat every bj G B up to the (3m + l)st level, it follows that 
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||V"|| = m and each bj S B can gain only one additional point. Thus, the m voters in V" correspond 
to an exact cover for B. □ 



Lemma 3.16. Bucklin voting is resistant to constructive control by deleting voters. 

Proof. Susceptibility holds by Lemma [331 Let {B,y) be an X3C instance as above. Define the 
election (C,V), where C = BU{c,w}UDUFUG is the set of candidates withD = {(ii,(i27- • • ;'3?3nm}» 
P = {/i,/2, ■ • ■ ,/3«(m-i)}, and G = {gi,g2, • ■ • ,g3m(m-i)}> and where w is the distinguished candi- 
date. For each j, I < j < 3m, define ij = \\{Si ^ ■y\bj ^ Si]\\, and for each /, I <i<n, definqj 

Bi = {bj£B\i<n-ij}, 

A' = {'5?((-i)3m+i7--- )'3^3™-||B,||}) and 

Fi = {f{i-l){3m-3) + lj---ifi{3m-3)}- 



Also, for each ^, l<^<m— 1, define Gk = {g3m{k-i)+i 
collection of 2« + m — 1 voters: 



,■■■ ,g3mk}- Let V consist of the following 



# 


For each . . . 


number of 
voters 


ranking of candidates 


1 


i€{l,...,n} 


1 


Si c Fi D (B-Si) G (F-Fi) w 


2 


/G{1,...,«} 


1 


Bi Di w F (D-Di) (B-Bi) G c 


3 


^G{l,...,m-1} 


1 


c Gk F D {G-Gk) B w 



Candidate c is the unique level 4 BV winner in the election (C, V). 

We claim that .y has an exact cover for B if and only if w can be made the unique BV winner 
by deleting at most m voters. 

From left to right: Suppose y contains an exact cover for B. By deleting the corresponding 
voters from the first voter group, we have the following level 3m + 1 scores in the resulting election 
{C,V'): 



score^^"p-^{w) 
score\^+\{bi) 



score 



3m+\ 
(CV) 



(C) 



1 for all /, 1 < / < 3m, 



score 



score 



3m+l 

(cy) 

3m+l 

icy) 



(dj) 
ifj) 



1 or score'l^p. (dj) = for all dj € D, and 



'{C,V' 



score 



3m+l / 



1 for all fj G F and all gk G G. 



Since now there are 2?i — 1 voters in the election, candidate w is the first candidate having a strict 
majority, so w is the unique BV winner of election (C, V'). 

From right to left: Suppose w can be made the unique BV winner by deleting at most m voters. 
Since w doesn't score any points on any of the first 3m levels (see Footnote [5]l, neither c nor any 
of the bi can have a strict majority on any of these levels. In particular, candidate c must have lost 
exactly m points (up to the (3m + l)st level) after deletion, and this is possible only if the m deleted 



'Note that Dj = if ||B,|| = 3m and that w is always ranked at or later than the (3ra + l)st position. 
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voters are all from the first or third voter group. On the other hand, each bt E B must have lost at 
least one point (up to the (3m + l)st level) after deletion, and this is possible only if exactly m voters 
were deleted from the first voter group. These m voters correspond to an exact cover for B. □ 



Lemma 3.17. Bucklin voting is vulnerable to destructive control by adding and deleting voters. 



Proof. Susceptibility holds by Lemma [331 The polynomial-time algorithms that solve the two 
control problems for fallback voting [.ERIO] can easily be adapted (e.g., by adjusting the input 
format from fallback elections to that for Bucklin elections) to work for Bucklin voting as well, 
as Bucklin voting is the special case of fallback voting where each voter approves of all candi- 
dates. □ 



Lemma 3.18. Bucklin voting is resistant to constructive control by partition of voters in both tie- 
handling models, TE and TP. 



Proof. Susceptibility holds by Lemma [331 To show NP-hardness we reduce X3C to our control 
problems. Let {B,y) be an X3C instance with B = {bi,b2,---,bi„n}, m > 1, and a collection 
y = {Si,S2,- --jSn} of subsets Si C B with ||5;|| = 3 for each /, I < i <n. We define the election 
{C,V), where C = BU {c,w,x}[JD[JEUF UG is the set of candidates with D = {di ,... , c?3„m}^ 
E = {ei,.. . ,£'(3m-i)(m+i)}> F = {fi,... ,/(3m+i)(«i-i)}, and G = {gi, . . . ,g„(3m-3)}> and where w is 
the distinguished candidate. For each j, I < j < 3m, define £j = \\{Si e y\bj € Si}\\, and for each 
i, 1 < i < «, define 



B 
D 
G, 



{bj £B\i<n-£j}, 

{'^(;-l)3m+l) • • • 5'^3im-||B,||}i ^nd 
{^(!-l)(3m-3)+l) • • • )g((3m-3)}- 



Also, for each k, I <k <m+l, define E^ = {e(^2f„-i){k-i)+ij- ■ ■ T^{3m-i)k}^ and for each /,!</< 
m—l, define F/ = {/(3m+i)(/-i)+i > • • • )/(3m+i)/}- Let V consist of the following 2n + 2m voters: 



# 


For each . . . 


number of 
voters 


ranking of candidates 


1 


iG{l,...,n} 


1 


c Si Gi (G-Gi) F D E (B-St) w x 


2 


iG{l,...,n} 


1 


Bi Di w G E (D-Di) F (B-B,) c x 


3 


k£{l,...,m+l} 


1 


X c Ek F {E-Ek) G D B w 


4 


/G{l,...,m-1} 


1 


Fi c (F-F,) G D E B w X 



In this election, candidate c is the unique level 2 BV winner with a level 2 score of n + m + 1. 

We claim J^ has an exact cover J^' for B if and only if w can be made the unique BV winner of 
the resulting election by partition of voters in both tie-handling models TE and TP. 

From left to right: Suppose y has an exact cover y' for B. Partition V the following way. Let 
Vi consist of: 
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• the m voters of the first group that correspond to the exact cover (i.e., those m voters of the 
form c Si Gi (G - G,) F D E {B-Sj) w x for which St G ,9") and 

• the m + 1 voters of the third group (i.e., all voters of the form 

X c Ek F {E-Ek) G D B w. 

Let V2 = y — Vi. In subelection (C, Vi), candidate x is the unique level 1 BV winner. In subelection 
(C, V2), candidate w is the first candidate who has a strict majority and moves on to the final round 
of the election. Thus there are w and x in the final run-off, which w wins with a strict majority on 
the first level. Since both subelections, {C,V\) and (C,V2), have unique BV winners, candidate w 
can be made the unique BV winner by partition of voters in both tie-handling models, TE and TP. 

From right to left: Suppose that w can be made the unique BV winner by exerting control by 
partition of voters. Let (Vi,V2) be such a successful partition. Since w wins the resulting two- 
stage election, w has to win at least one of the subelections (say, w wins (C, Vi)). If candidate c 
participates in the final round, he or she wins the election with a strict majority no later than on the 
second level, no matter which other candidates move forward to the final election. That means that 
in both subelections, (C, V\ ) and (C, V2), c must not be a BV winner. Only in the second voter group 
candidate w (who has to be a BV winnner in {C,V\)) gets points higher than on the second-to-last 
level. So w has to be a level 3m + 1 BV winner in (C, Vi ), which implies that there have to be voters 
from the second voter group in V\. Therefore, in subelection (C, V2) only candidate x can prevent c 
from moving forward to the final round. Since x is always placed behind c in all votes except those 
votes from the third voter group, x has to be a level 1 BV winner in (C, Vj)- Since in (C, V\ ) it is not 
possible that a candidate can tie with w on the (3m + l)st level, w has to be the unique level 3m + 1 
BV winner in (C, Vi). Thus both elections {C,V\) and (CjVi) have unique BV winners and so the 
construction works for both tie-handling models, TE and TP. 

It remains to show that 5^ has an exact cover y" for B. Since w has to win (C, V\ ) with the 
votes from the second voter group, not all voters from the first voter group can be in V\ (otherwise 
c would have n points already on the first level). On the other hand, there can be at most m voters 
from the first voter group in V2 because otherwise x would not be a level 1 BV winner in (C,V2)- 
To ensure that no candidate contained in B has the same score as w, namely n points, and gets these 
points on an earlier level than w in {C,Vy), there have to be exactly m voters from the first group in 
V2 and these voters correspond to an exact cover for B. □ 



4 Conclusions and Open Questions 

We have shown that Bucklin voting is resistant to all standard types of candidate control and all 
standard types of constructive control. In total, it possesses at least 18 resistances to the 22 com- 
monly studied control types, it has at least two (and can have no more than four) vulnerabilities, and 
two cases remain open: destructive control by partition of voters in both tie-handling models, TE 
and TP. For comparison, recall from Table [T] that, for destructive control by partition of voters, ap- 
proval voting is vulnerable both in model TE and TP, SP-AV is vulnerable in model TE but resistant 
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in model TP, and fallback voting is resistant in model TP and it is open whether fallback voting is 
vulnerable or resistant to this control type in model TE. 

Only SP-AV and fallback voting are currently known to be resistant to one more control type 
than Bucklin voting. However, Bucklin voting is arguably a simpler and more natural voting system; 
for example, unlike SP-AV and fallback voting, it is a majority-consistent voting rule. 
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A Some Results of [HHR07] Used in Section E 



Theorem A.l ( IIHHR071 ). 1. If a voiced voting system is susceptible to destructive control by 
partition of voters (in model TE or TP), then it is susceptible to destructive control by deleting 
voters. 

2. Each voiced voting system is susceptible to constructive control by deleting candidates. 

3. Each voiced voting system is susceptible to destructive control by adding candidates}^ 

Theorem A.2 ( IIHHR07I ). 1. A voting system is susceptible to constructive control by adding 
candidates if and only if it is susceptible to destructive control by deleting candidates. 

2. A voting system is susceptible to constructive control by deleting candidates if and only if it 
is susceptible to destructive control by adding candidates. 

3. A voting system is susceptible to constructive control by adding voters if and only if it is 
susceptible to destructive control by deleting voters. 

4. A voting system is susceptible to constructive control by deleting voters if and only if it is 
susceptible to destructive control by adding voters. 

Theorem A.3 ( IIHHR07I ). l.Ifa voting system is susceptible to constructive control by parti- 
tion of voters (in model TE or TP), then it is susceptible to constructive control by deleting 
candidates. 

2. If a voting system is susceptible to constructive control by partition or run-off partition of 
candidates (in model TE or TP), then it is susceptible to constructive control by deleting 
candidates. 

3. If a voting system is susceptible to constructive control by partition of voters in model TE, 
then it is susceptible to constructive control by deleting voters. 

4. If a voting system is susceptible to destructive control by partition or run-off partition of 
candidates (in model TE or TP), then it is susceptible to destructive control by deleting can- 
didates. 



^Following Bartholdi et al. fBTT921, Hemaspaandra et al. fHHRO?! considered only the case of control by adding a 
limited number of candidates — the "unlimited" case was introduced only in (the conference precursors of) |FHHR09a|. 



However, it is easy to see that all results about control by adding candidates stated in Theorems I A. 11 [AT2l and |A.3| hold 
true in both the limited and the unlimited case. 
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